CVE-2022-4542

The CVE-2022-4542 issue affects the Compact WP Audio Player WordPress plugin prior to version 1.9.8. It arises from not validating and escaping certain shortcode attributes before output, allowing a user with as little as Contributor privileges to perform Stored XSS against higher-privilege users...

CVE-2021-24735

The CVE-2021-24735 entry concerns the WordPress plugin Compact WP Audio Player (pre-1.9.7). Connected sources corroborate a CSRF vulnerability caused by missing nonce checks, enabling an attacker with a logged‑in admin session to change the Disable Simultaneous Play setting. Affected version rang...

CVE-2021-24734

The CVE-2021-24734 entry affects the WordPress Compact WP Audio Player plugin (versions prior to 1.9.7). The root cause is insufficient escaping of shortcodes attributes, enabling Stored XSS by users with as low as Contributor. Impact is client-side JavaScript execution in affected pages. Remedia...